For a large group of UAE businesses, anti-money-laundering compliance is no longer a background formality — it is a licence-critical, board-level obligation. At the centre of it sits goAML: the reporting platform of the UAE Financial Intelligence Unit (FIU) that regulated businesses must register on and use. If your company is a Designated Non-Financial Business or Profession (DNFBP) — an accountant, auditor, corporate service provider, real estate broker, dealer in precious metals and stones, or independent legal professional — registration is mandatory, and it is only the first step in a wider AML/CFT programme.
This guide explains what goAML is, who must register, the legal basis following the UAE’s 2025 AML reforms, how to register step by step, the ongoing obligations that come with registration, how reporting works, and the penalties for getting it wrong.
― What is goAML?
goAML is an integrated reporting system developed by the United Nations Office on Drugs and Crime (UNODC) and used by financial intelligence units around the world. In the UAE — the first Gulf state to adopt it — the FIU uses goAML as its single, secure channel to receive, analyse and act on suspicious-transaction intelligence from financial institutions and DNFBPs. When you file through goAML, you are discharging a statutory reporting duty and feeding the national framework for detecting and disrupting financial crime.
― Who must register on goAML?
Registration is mandatory for Financial Institutions (FIs), Virtual Asset Service Providers (VASPs) and DNFBPs — and it applies across the board, to mainland and free zone entities alike. The DNFBP category captures:
- Real estate brokers and agents who arrange the purchase or sale of property.
- Dealers in precious metals and stones, for cash or wire transactions at or above AED 55,000.
- Auditors and accountants providing professional services to clients.
- Corporate and trust service providers (CSPs) offering company formation or administration.
- Independent legal professionals and notaries, for defined categories of transaction.
- Gaming operators — a category brought into scope under the 2025 Executive Regulations.
| No free-zone exemptiongoAML registration does not depend on where you are licensed. Whether you operate on the mainland or inside a free zone, if you fall within a DNFBP category, registration is a prerequisite for keeping your licence in good standing. |
― The legal basis: Federal Decree-Law No. 10 of 2025
The UAE overhauled its AML framework in late 2025. Federal Decree-Law No. 10 of 2025 on combating money laundering, terrorism financing and proliferation financing came into force on 14 October 2025, repealing and replacing the previous Federal Decree-Law No. 20 of 2018. Its Executive Regulations — Cabinet Decision No. 134 of 2025 — came into force on 14 December 2025, replacing Cabinet Decision No. 10 of 2019. The reform aligns the UAE more closely with Financial Action Task Force (FATF) standards ahead of the country’s upcoming mutual evaluation.
| Area | Previous framework (2018) | New framework (2025) |
|---|---|---|
| Core statute | Decree-Law No. 20 of 2018 | Decree-Law No. 10 of 2025 |
| Executive Regulations | Cabinet Decision No. 10 of 2019 | Cabinet Decision No. 134 of 2025 |
| Offences covered | Money laundering & terrorism financing | Adds proliferation financing as a standalone offence |
| Predicate crimes | Defined list | Expanded to include direct & indirect tax evasion |
| Liability | Primarily entity-level | Personal liability for senior management & directors |
Two shifts matter most for DNFBPs. First, the evidentiary threshold is lower — knowledge of illicit funds can now be inferred from objective circumstances. Second, responsibility can no longer be fully delegated to a compliance officer or external adviser: senior individuals can face personal liability for failures such as inadequate systems and controls or a missed report.
― How to register on goAML: step by step
Registration is a two-stage process — first through the FIU’s access-control system, then on the goAML portal itself. It is free of charge.
- Confirm you are in scope — check whether your activity falls within a DNFBP category.
- Appoint your AML/CFT Compliance Officer (also referred to as the MLRO), who will oversee AML measures and file reports.
- Pre-register in the SACM (Service Access Control Manager) protection system and obtain a username.
- Install Google Authenticator to generate the one-time password used to access the portal.
- Complete registration on the goAML portal, selecting the “Reporting Entity” registration type.
- Submit your documents and await approval from the Ministry of Economy.
- Once approved, activate your reporting account and begin meeting your reporting obligations.
― Documents required for goAML registration
Prepare the following, typically compiled into a single PDF for submission:
- The organisation’s authorisation letter in favour of the designated AML/CFT Compliance Officer.
- The Compliance Officer’s passport, residence visa and Emirates ID.
- A copy of the company’s valid commercial / trade licence.
― Ongoing AML/CFT obligations (registration is only the start)
Registering on goAML does not, by itself, make a business compliant. It plugs you into the reporting system; you still need a functioning AML/CFT programme around it:
- Appoint and empower an MLRO / Compliance Officer with the authority and independence to act.
- Conduct an enterprise-wide risk assessment appropriate to your business model and clients.
- Apply customer due diligence (CDD) and enhanced due diligence for higher-risk relationships, including UBO identification.
- Screen against sanctions and PEP lists and monitor transactions on an ongoing basis.
- File STRs / SARs without delay when suspicion arises.
- Keep records for at least five years, in line with the AML Law and FTA guidance.
- Maintain written AML policies, deliver staff training, and arrange independent review.
― Reporting through goAML: STR vs SAR
Two of the most common report types are frequently confused — and the distinction is operational, not semantic.
| Report | When it is filed |
|---|---|
| STR — Suspicious Transaction Report | A transaction, completed or in progress, shows clear indicators of illicit activity or money laundering. |
| SAR — Suspicious Activity Report | A client’s behaviour, background or intent appears suspicious, even if no transaction has been attempted or completed. |
| DPMSR / REAR | Sector-specific reports for dealers in precious metals & stones (DPMSR) and real estate activity (REAR). |
| What “without delay” meansUAE AML law requires reporting “without delay” — as soon as a reasonable suspicion is formed. There is no fixed number of days in the statute, and unjustified internal delay is itself treated as a regulatory breach. |
― Penalties for non-compliance
The consequences of failing to register or report operate on two levels — administrative and criminal — and the 2025 reforms raised the stakes considerably.
| Breach | Consequence |
|---|---|
| Failure to register on goAML / AML violations | Administrative fines commonly starting at AED 50,000, scaling up, with possible business restrictions or licence suspension |
| Money laundering by a legal person (under the 2025 law) | Criminal fines of AED 5 million to AED 100 million (up from the previous AED 500,000–50 million range) |
| Manager / director breach of duty | Personal criminal liability — imprisonment, fine, or both |
| Providing false UBO information | Imprisonment for knowingly supplying incorrect beneficial-ownership data |
The direction of travel is clear: broader scope, stronger supervisory powers, and a smaller margin for error. For DNFBPs, the practical implication is that AML compliance now needs genuine board-level attention and documented, demonstrable controls.
― How Rosemont Partners supports goAML & AML compliance
Rosemont Partners helps DNFBPs meet their AML/CFT obligations end to end — from goAML registration and MLRO support to enterprise risk assessments, policy drafting, STR/SAR filing and staff training. We help you build not just a registration, but a defensible compliance framework aligned with the 2025 law. To review your obligations and close any gaps, speak with our compliance team.
― Frequently asked questions
Is goAML registration mandatory in free zones?
Yes. DNFBPs in every emirate and free zone must register with the Ministry of Economy and comply with UAE AML laws — there is no jurisdictional exemption.
Is goAML registration free?
Yes. The goAML portal does not charge a registration fee for DNFBPs, VASPs or financial institutions.
How long does approval take?
It depends on how complete your documentation is, but registration is commonly completed within a few business days, subject to FIU / Ministry of Economy approval timelines.
Does registration alone make us compliant?
No. Registration connects you to the reporting system, but you must also implement internal policies, KYC procedures, ongoing monitoring, training and record-keeping to be compliant.
